StopAndWait defer errors

Trap: deferring StopAndWait looks like reliable cleanup because it runs on every return path, but an unchecked deferred error silently releases admission after D-Bus, subscription, or timeout failure while the PTY cgroup may remain. Fix: make cleanup an explicit lifecycle result, retain the capacity reservation until confirmed UnitRemoved, and surface cleanup failure instead of reporting successful termination.